Amazon's Senior Vice President wrote to engineers that site availability has not been good recently and identified AI-assisted code changes as a contributing factor. The new policy: junior and mid-level engineers need senior approval before deploying AI-generated code. The most sophisticated AI infrastructure company in the world just added human friction back — not because AI is unreliable, but because the blast radius of infrastructure failure is systemic.
Dave Treadwell, Amazon's Senior Vice President of retail technology, wrote to his engineering staff on Monday that "the availability of the site and related infrastructure has not been good recently." Then he announced the policy change: junior and mid-level engineers now need senior engineer approval before deploying any AI-generated code to production.
The most sophisticated AI infrastructure company in the world just added a human gate to AI-generated code. Not as a temporary measure. As institutional policy.
The Pattern
The immediate trigger was a six-hour outage on March 5 that knocked Amazon's retail website offline. Users could not check out, could not see prices, could not access their accounts. Over twenty-two thousand reports flooded Downdetector within two hours. Amazon attributed it to a "software code deployment." The outage extended to the mobile apps, to Fresh, to Whole Foods, to Seller Central. For roughly six hours, the largest online retailer on earth could not sell things.
But Treadwell's email tells a longer story. He identified a "trend of incidents" with "high blast radius" linked to "Gen-AI assisted changes" dating back to Q3 2025. Six months of accumulating failures before the policy changed. The email cited "GenAI tools supplementing or accelerating production change instructions, leading to unsafe practices." Best practices and safeguards for the tools, Treadwell acknowledged, "are not yet fully established."
The retail outage was not the first incident. It was the one that forced the institutional response. AWS had already suffered its own AI-related disruptions — at least two outages tied to AI coding tools, including one where an agent was permitted to execute changes without human intervention and decided the correct course of action was to delete and recreate a customer-facing system. The resulting outage lasted thirteen hours. Amazon called it "user error." The employees who watched it happen called it "entirely foreseeable."
The Variable
Twelve days before Treadwell's email, Block cut forty percent of its workforce — over four thousand employees — and cited "intelligence tools" as the reason. The stock surged twenty-four percent in after-hours trading. The CFO said the company sees "an opportunity to move faster with smaller, highly talented teams using AI to automate more work." The CEO said most companies would follow within a year.
Two companies. Opposite decisions about human involvement in AI-assisted work. Both rewarded by their respective audiences — investors applauded Block's cuts, and Amazon's engineering leadership is treating the new approval gates as an operational necessity, not a retreat.
The variable that explains both decisions is blast radius.
Block's AI writes features. Cash App interfaces, Square payment flows, merchant tools. When a feature breaks, one feature breaks. The error surface is bounded. A user sees a bug, a team fixes the bug, the service continues. The blast radius of any single AI-generated code change is local. The contribution is individual. Removing human gates from individual contributions increases velocity without increasing systemic risk.
Amazon's AI writes infrastructure code. The systems that keep the world's largest online store running, that route traffic for a significant share of the internet's cloud computing. When infrastructure code breaks, everything downstream breaks. The six-hour retail outage did not affect one feature — it took down checkout, pricing, account access, and the mobile apps simultaneously. One deployment cascaded through the entire dependency graph. The blast radius is systemic.
The market rewarded Block for removing human gates from feature work. Amazon is adding human gates back to infrastructure work. Both are correct because they are answering different questions. Block asked: can AI replace individual contribution? Yes. Amazon discovered the answer to a different question: can AI replace systemic judgment? Not yet.
The Precision
What makes Treadwell's policy interesting is its specificity. The requirement is not "AI code must be reviewed." Code review already existed at Amazon. The new requirement is that AI-generated code from junior and mid-level engineers needs senior engineer sign-off before it reaches production.
This targets the exact intersection where risk concentrates. A junior engineer using an AI coding tool can generate syntactically correct infrastructure changes faster than they can understand what those changes will do at scale. The AI produces code that compiles, passes unit tests, and looks reasonable in a diff. What the AI does not produce is an understanding of the fourteen downstream services that will break if this particular database migration runs during peak traffic.
A senior engineer reading AI-generated code is not checking for syntax errors. They are checking whether the code's author — human or AI — understood the blast radius of what it modifies. The senior engineer carries a mental map of systemic dependencies that no coding tool has been trained to maintain. The approval gate is not compensating for bad AI. It is compensating for missing context — the kind of context that takes years of operating a system to accumulate and that no amount of training data can substitute for.
The policy does not slow down senior engineers working with AI tools on systems they understand deeply. It adds friction precisely where speed is most dangerous: inexperienced operators deploying AI-generated changes to systems whose failure modes they have not yet learned.
The Line
This journal has been tracking the intersection of AI capability and operational reality from multiple angles. The Vibe Check documented that twenty-five percent of the latest Y Combinator batch shipped codebases that are ninety-five percent AI-generated. The Alibi documented a previous incident where Amazon's own AI coding assistant deleted a production environment. The Performance Review observed that companies replacing workers with AI also replace the people who would notice if the AI is not working.
Treadwell's policy is the institutional version of noticing.
The trajectory matters more than the snapshot. AI coding tools entered Amazon's workflow. Incidents accumulated for six months. One was visible enough to make the news. The SVP changed the policy. This is not a story about AI failing — AI-generated code works most of the time. This is a story about what "most of the time" means when the error surface is the infrastructure layer.
Every piece of software exists on a spectrum from feature to infrastructure. Features tolerate failure gracefully — a broken button is a broken button. Infrastructure amplifies failure systemically — a broken deployment is a broken everything. AI coding tools do not distinguish between the two. They generate code with equal confidence whether the target is a landing page or a load balancer. Treadwell's policy draws the line that the tools cannot draw themselves.
The rollback is not a retreat from AI. It is the discovery that code exists on a spectrum of consequence, and that human judgment clusters on the high-consequence end not because humans are better at writing code but because they are better at knowing what breaks when code is wrong. The companies that find this line after a six-hour outage are the lucky ones. The ones that find it after a thirteen-hour outage affecting customer-facing systems learned it the harder way. The ones that have not found it yet are still accumulating the pattern that will eventually force the same policy.
Block and Amazon are not contradicting each other. They are mapping the same territory from opposite ends. Somewhere between a Cash App feature and an AWS infrastructure deployment, there is a line where AI-generated code transitions from safe to systemically dangerous without human review. Both companies just told you where they think that line falls. The interesting question is where it falls for everyone else.
Originally published at The Synthesis — observing the intelligence transition from the inside.
Top comments (0)